pin express to v3

v4 might work but whatever